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CLAIMS 

1. In a network-connected integrated circuit device, a 
method for securely provisioning configuration data, the method 
comprising: 

5 receiving configuration data; 

loading the configuration data; and, 
locking to prevent the loading of subsequently received 
configuration data. 



10 2. The method of claim 1 wherein receiving configuration 

p data includes receiving data bytes addressed to device registers; and, 

fll wherein loading the configuration data includes loading the 

i - ii 

S received data in configuration registers. 

i* 

15 3. The method of claim 2 wherein locking to prevent the 

|"U loading of subsequently received configuration data includes: 

M establishing at least one locking register having a first 

!■* address; 

loading a first lock set in the locking register; and, 
20 in response to loading the first lock set in the locking 

register, preventing the loading of received data in the configuration 
registers. 



25 



4. The method of claim 3 wherein loading a first lock set 
in the locking register includes loading a first lock set having a unique 
value. 
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5. The method of claim 4 wherein loading the received 
data in configuration registers includes: 

loading a non-lock set, not equal to the first lock set, in the 
5 locking register; and, 

in response to loading the non-lock set in the locking register, 
loading received data in the configuration registers. 

6. The method of claim 5 wherein loading a non-lock set, 
10 not equal to the first lock set, in the locking register includes loading a 

key set having a unique value; and, 

wherein loading received data in the configuration registers 
in response to loading the non-lock set in the locking register includes 
loading received data in response to the key set. 

15 

7. The method of claim 5 wherein locking to prevent 
subsequent loading of configuration data includes: 

establishing a first locking register having a first address 
and a second locking register having a second address; 
20 loading a first lock set in the first locking register and a 

second lock set in the second locking register; and, 

in response to loading the first lock set in the first locking 
register and the second lock set in the second locking register, preventing 
the loading of received data in the configuration registers. 



25 
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8. The method of claim 7 wherein establishing a first 
locking register having a first address and a second locking register 
having a second address includes establishing non-contiguous first and 
second addresses. 

9. The method of claim 8 wherein establishing a first 
locking register having a first address and a second locking register 
having a second address includes the first and second lock sets having 
values that are equal 

10. The method of claim 8 wherein establishing a first 
locking register having a first address and a second locking register 
having a second address includes the first and second lock sets having 
values that are unequal. 



11. The method of claim 7 wherein locking to prevent the 
loading of subsequently received configuration data includes: 

establishing a plurality of locking registers having a 
corresponding plurality of addresses; 
20 loading a lock set in each corresponding locking register; 

and, 

in response to loading the plurality of lock sets in the 
corresponding locking registers, preventing the loading of received data in 
the configuration registers. 



12. The method of claim 5 further comprising: 
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following the loading the first lock set in the locking register, 
loading a non-lock set in the locking register; and, 

in response to the non-lock set, permitting write access to the 
configuration registers. 

5 

13. The method of claim 12 wherein loading a non-lock set 
in the locking register includes the non-lock set being a key set having a 
unique value. 

10 14. In a system of networked devices, a method for 

securely provisioning configuration data, the method comprising: 
booting the system up; 

supplying data to provision at least one network-connected 

device; and, 

15 locking the network-connected device to prevent subsequent 

data provisioning. 

15. The method of claim 14 wherein supplying data to 
provision at least one network-connected device includes: 
20 supplying data bytes addressed to the device registers; and, 

loading the received data in the device configuration 

registers. 



25 



16. The method of claim 15 wherein locking the network- 
connected device to prevent subsequent data provisioning includes: 
supplying at least a first lock set; 
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loading the first lock set in at least one locking register 
having a first address; and, 

in response to loading the first lock set in the locking 
register, preventing the loading of subsequently provisioned data in the 
5 device configuration registers, 

17. The method of claim 16 wherein loading a first lock set 
in at least one locking register having a first address includes loading a 
first lock set having a unique value. 

10 

18. The method of claim 17 wherein supplying data to 
provision at least one network-connected device includes: 

supplying a non-lock set, not equal to the first lock set; 
loading the non-lock set in the device locking register; and, 
15 in response to loading the non-lock set in the locking register, 

provisioning the device configuration registers. 

19. The method of claim 18 wherein supplying a non-lock 
set, not equal to the first lock set includes supplying a key set having a 

20 unique value. 

20. The method of claim 18 further comprising: 
following the loading the first lock set in the locking register, 

loading a non-lock set value in the locking register; and, 
25 in response to the non-lock set, permitting write access to the 

configuration registers. 
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21. The method of claim 20 wherein the non-lock set is a 
key set having a unique value. 

22. In a network integrated circuit device, a system for 
securely provisioning configuration data, the system comprising: 

a plurality of configuration registers having a corresponding 
plurality of addresses, wherein the device in configured in response to the 
data in the configuration registers; and, 

at least one locking register, having a first address, to 
prevent the loading of data in the configuration registers. 

23. The system of claim 22 wherein the locking register is 
loaded with a first lock set, and wherein the locking register prevents the 
loading of data in the configuration registers in response to the first lock 
set. 

24. The system of claim 23 wherein the first lock set has a 
unique value. 

25. The system of claim 24 wherein the locking register is 
loaded with a non-lock set not equal to the first lock set, and wherein the 
locking register permits the loading of data in the configuration registers 
in response to the non-lock set. 



applied_106 



-21- 



15 



s'ii :: 



26. The system of claim 25 wherein the locking register is 
loaded with a key set having a unique value, and wherein the locking 
register permits the loading of data in the configuration registers in 
response to the key set. 

5 

27. The system of claim 25 wherein the at least one 
locking register includes a first locking register having a first address and 
a second locking register having a second address, and wherein the first 
and second locking registers prevent the loading of data in the 

10 configuration registers in response to loading first and second lock sets, 
respectively, in the first and second locking registers. 

28. The system of claim 27 wherein the first and second 
locking registers have non-contiguous first and second addresses. 



29. The system of claim 27 wherein the first and second 
lock sets have values that are equal. 

30. The system of claim 27 wherein the first and second 
20 lock sets have values that are not equal. 

31. The system of claim 25 wherein the at least one 
locking register includes a plurality of locking registers having a 
corresponding plurality of addresses, and wherein the plurality of locking 

25 registers prevent the loading of data in the configuration registers in 
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response to loading a plurality of lock sets in the corresponding plurality 
of locking registers. 

32. The system of claim 25 wherein the at least one 
locking register accepts a non-lock set, following the loading the first lock 
set, and permits write access to the configuration registers in response to 
the non-lock set. 

33. The system of claim 32 wherein the non-lock set is a 
key set with a unique value. 



